Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
3e97e049589cbfae5a979dab775e01bd_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3e97e049589cbfae5a979dab775e01bd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3e97e049589cbfae5a979dab775e01bd_JaffaCakes118.html
-
Size
27KB
-
MD5
3e97e049589cbfae5a979dab775e01bd
-
SHA1
a41f1109c2be47432e91431ea912fc7ecffe2291
-
SHA256
953a632910f5333530ccce7c13d0384737b95ba92fa7649d2bc8ed4d42c9513d
-
SHA512
ef1f94bef6f0fcbd961a8802e484098675134f7cbeb75f14a5b11eb387c97b1e7d6e96d7817671ffdcdb4f9d2533a59cddca4b8867120bc099f52bcb3cc83be2
-
SSDEEP
192:uwDkb5n+OnQjxn5Q/BnQiecNnGnQOkEntPTnQTbnRnQ9eqgm6utQiQl7MB8qnYnf:TQ/y/Y8Q1Sm5NR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4780 msedge.exe 4780 msedge.exe 3040 msedge.exe 3040 msedge.exe 3352 identity_helper.exe 3352 identity_helper.exe 2480 msedge.exe 2480 msedge.exe 2480 msedge.exe 2480 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe 3040 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2816 3040 msedge.exe 84 PID 3040 wrote to memory of 2816 3040 msedge.exe 84 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 3332 3040 msedge.exe 85 PID 3040 wrote to memory of 4780 3040 msedge.exe 86 PID 3040 wrote to memory of 4780 3040 msedge.exe 86 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87 PID 3040 wrote to memory of 2136 3040 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3e97e049589cbfae5a979dab775e01bd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e347182⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:82⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:2940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8871063309508327482,14365195989525248870,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3444
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
6KB
MD5e082e4e710ac55a191be151595cfeab9
SHA1ba654d4efdd35aca3dd2a6a7b4de34c3cd74e2f1
SHA2564ad2379844df3973902eddb66d9de0e746cd6327a603272a61fb3f9b9bb6ba91
SHA512c019bbc96986d1e3a1da924b11b2748263808699fc3d03135b4cece4d269d2a0cb07d5dd1fb37233b83aeee7b9e26ce76e37447be6a10a82ce24832f064b3ade
-
Filesize
6KB
MD5ac8d2dcfb1b1a1eeeb55167c6bbc9d6c
SHA11aa5b1251ede4612918b32975f70f9fdebbac8ab
SHA2561836eef99c7dd3882150ba46b1a7b485afa2b24f69a6f67e9e336ee3916140c9
SHA51283d43412a30b618077e72d5c481db56925982dfd2b86ab4138e36a9705a54f3dcd79604614f5cbf8bd294a64e3fbf2999b3abf0aedeeae3b7fb21f13d110816e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD57f92fcc0af4aff4751bfe73faf765dc1
SHA1269f400b1c971a47740bf38733cefdf447ba5d2a
SHA2560fba815e5cf8d5b3124caef99f0c8e8700bc51c81faea853968eee6405c5f4bd
SHA512f53b0b6dc2d8a0c1d35f2a9334caf38f03861fcd6a6ccd5299bf8e00ad1ce64aa9e0c41617ff59c2e566f10066b30ba5e33d1b05626c88e8f292e9e33fbade9e